CVE-2019-9153: Message Signature Bypass in openpgp
Summary
CVE-2019-9153: Message Signature Bypass in openpgp. Affects openpgp versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The openpgp package is an open-source library for implementing the OpenPGP encryption standard. It provides functionality for generating and verifying digital signatures, encrypting and decrypting data, and managing key pairs. The package is widely used in various applications that require secure communication and data protection. However, versions prior to 4.2.0 of openpgp are vulnerable to a Message Signature Bypass vulnerability.
Vulnerability Detail
The Message Signature Bypass vulnerability in openpgp arises from the package's failure to verify that a message signature is of type 'text'. This allows an attacker to construct a message with a signature type that only verifies subpackets without additional input, such as 'standalone' or 'timestamp'. By capturing a 'standalone' signature packet from a victim, an attacker can create arbitrary signed messages that would be verified correctly. This vulnerability can lead to the manipulation of signed messages and potential unauthorized access or data tampering.
How To Fix
Minimum fixed version
4.2.0
This is the first release that contains the fix.
npm install openpgp@4.2.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the openpgp package to address the issue.
Conclusion
The Message Signature Bypass vulnerability in openpgp exposes applications to the risk of message manipulation and unauthorized access. Upgrading to version 4.2.0 or later of the openpgp package is crucial to mitigate this vulnerability. There are no known workarounds, and it is recommended to address the issue promptly. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openpgp →
FAQ
This vulnerability allows an attacker to manipulate signed messages and potentially gain unauthorized access or tamper with data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to address the vulnerability promptly by upgrading to the fixed version of the openpgp package.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version of the openpgp package is necessary to mitigate the risk.
For further information and support on vulnerability remediation, you can contact info@devnack.com.
References
Related vulnerabilities
Recent vulnerabilities recorded for openpgp.
